Security

hosaypeng Bundle

Scan all Claude skills for quality issues: inline bash that should be extracted to scripts, missing metadata, naming violations, broken cross-references, and script convention violations. Use when adding new skills, after refactoring skills, or periodically for hygiene.

hosaypeng Bundle

Validate repository is safe for public release. Scans for secrets, personal info, large files, and .gitignore gaps.

hugoduncan Skill

Use gordian to analyse Clojure code structure at namespace and executable-unit level. Invoke when asked to audit architecture, assess coupling, identify hidden dependencies, interpret suspicious namespace pairs, rank architectural refactor targets, produce evidence-backed target issue descriptions, review test structure, compare architectural snapshots, inspect a subsystem, find local cyclomatic/LOC hotspots, or find local comprehension-burden hotspots. Produces structural, conceptual, change-coupling, local-metric, local-burden, target-ranking, and issue-description signals plus triage and workflow commands.

jerseycheese Skill

Finds and removes dead or trivial tests - duplicates, tests that only assert a mock was called, render checks that prove nothing, and suites whose name promises behavior they never observe. Distinguishes a test that tests nothing from one that tests the wrong thing, because those need opposite fixes. Trigger on: "test reaper", "reap tests", "remove trivial tests", "dead tests", "useless tests", "our tests don't test anything", "prune the test suite", "test audit", "which tests are worthless", "tests that always pass". For tests that are FAILING, use test-fix. For removing tests because their source is dead, use dead-code-cleanup.

jerseycheese Skill

Finds and removes unnecessary code comments - the ones that restate the code, cite an issue number, narrate refactor history, or wrap a one-line function in six lines of JSDoc. Sorts every find into auto-fix, propose, or never-touch, so the WHY comments survive the sweep. Trigger on: "comment reaper", "reap comments", "remove unnecessary comments", "too many comments", "verbose comments", "clean up the comments", "strip redundant JSDoc", "comment audit", "comment hygiene", "our comments are noise". For comments that are WRONG rather than merely unnecessary, use doc-rot. For comments that are hard to READ rather than unnecessary, use plain-language-audit.

jerseycheese Skill

Kicks off a recurring code-health audit — the "embarrassing code" / overengineering sweep that turns vague tech-debt anxiety into a short list of measurable, validated simplifications to ship. Bakes in the pre-flight discipline (sync the correct base branch, confirm the active worktree and its dev server, list files in scope) so the audit never runs against stale or wrong-worktree code. Trigger on: "embarrassing code audit", "overengineering audit", "code health audit", "find simplification candidates", "what can we simplify", "tech debt sweep", "audit the codebase", "find overengineered code", "what's embarrassing in this repo".

jerseycheese Skill

Sweeps a codebase's text — comments, docstrings, markdown docs, and user-facing UI copy — for jargon that could be plainer, AI writing tells/tropes, and verbose text that could be tightened. Auto-fixes unambiguous swaps, surfaces judgment calls for review. Trigger on: "jargon audit", "plain language audit", "find jargon", "sounds too technical", "AI tells", "AI slop in the docs", "sounds like AI wrote this", "too wordy", "make this more concise", "simplify this copy", "plain-language sweep". For code correctness/structure issues (fake fallbacks, dead logic), use dead-code-cleanup or code-health-audit instead — this skill is prose/tone only.

meteor Bundle

Use when auditing or hardening a Meteor 3 application. Triggers on missing check() on method arguments, missing this.userId guards on publications, browser-policy CSP, DDPRateLimiter rules, oauth-encryption via Accounts.config oauthSecretKey, audit-argument-checks, allow/deny legacy patterns, BrowserPolicy.content.disallowInlineScripts, BrowserPolicy.framing.disallow. Use this skill when the user asks about hardening, asks about a security review, or asks about CSP for a third-party script (Stripe, Google Maps, fonts).

microsoft Bundle

Use when asked to review code, review a branch, or do a code review. Spawns Breaker (correctness) and API Analyst (compatibility/conventions) sub-agents while the orchestrator reviews architecture, tests, performance, and security.

maragudk Bundle

Perform a thorough security review of the project, starting from a randomly selected file. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check the codebase for security issues. Also trigger when the user mentions "check for vulnerabilities", "find security bugs", "OWASP", or any request related to assessing the security posture of the project.

velcrafting Skill

Define and enforce authorization rules for protected actions, with tests and audit considerations.

velcrafting Skill

End-of-work audit that identifies which governance artifacts should be updated based on actual changes. Use when wrapping a milestone/checkpoint or after multi-file/structural work.

velcrafting Skill

Ensure logging/metrics/tracing and auditability match the quality bar for changed behavior.

octanejs Bundle

Audit one, several, or all existing Octane bindings; implement selected maintenance findings or remove redundant copied files with evidence matched to source ownership. Use for binding updates, lifecycle fixes, dependency or metadata maintenance, and convenience-import requests.

octanejs Skill

Audit or defend Octane performance. Use when a change can affect per-render, per-node, compiler-output, SSR, hydration, or bundle cost, or when asked whether something is fast enough.

litestar-org Bundle

Auto-activate for litestar_security, SecurityPlugin, SecurityConfig, CurrentUser, Principal, SecurityContext, requires_role, requires_scope, requires_authenticated, requires_tenant, requires_tenant_role, requires_capability, or requires_assurance. Not for raw auth guards alone — use litestar-auth-guards.

scoobydrew83 Bundle

Initialize a repo for the Conductor Method loop: write init.sh, seed FEATURES.json from the spec, create CONTEXT.md and MEMORY_BANK.md, verify a one-command test and a one-command lint actually pass, and land the baseline commit `loop(0): baseline green + criteria defined`. Use whenever someone is standing up a builder/verifier loop on a repo that doesn't have one yet, or says "set up the conductor loop here", "initialize this repo for the loop", "do Phase 0", "get this repo loop-ready", "seed FEATURES.json", or asks why the verifier keeps returning BLOCKED on a fresh project (the answer is almost always missing acceptance criteria, which is what this skill installs). Also use on an existing repo to audit and repair a half-done Phase 0. Do NOT trigger to design the loop itself or write its prompts — that is `loop-creator`; this skill only prepares the ground the loop runs on.

scoobydrew83 Bundle

Audit a repository's Conductor harness without changing it. Use when someone asks whether the loop is ready, why routing is blocked, whether state and policy agree, or to diagnose aliases, generated packages, criteria, evidence, queue transitions, and required tests. With `--library-root`, it also audits instruction aliases and the generated Marketplace package. It returns Conductor verdict PASS, FAIL, or BLOCKED with directly actionable repairs. Do NOT use it to silently repair a repository; it is read-only by design.

kaakati Bundle

Expert session decisions for iOS/tvOS: token storage security levels, refresh flow architectures, multi-session handling strategies, and logout cleanup requirements. Use when implementing authentication, debugging token issues, or designing session architecture. Trigger keywords: session, authentication, token, Keychain, refresh token, access token, JWT, OAuth2, logout, session expiration, KeychainHelper, SecItemAdd, kSecAttrAccessible

shieldnet-360 Bundle

OWASP API Top 10 for HTTP, GraphQL, and gRPC endpoints: input validation, route rate limiting, mass assignment, response caching, and gateway-versus-service control placement. Use when generating or reviewing HTTP handlers, GraphQL resolvers, gRPC service methods, or any API endpoint change.

shieldnet-360 Bundle

Authentication and authorization: JWT, OAuth 2.0 / OIDC, session management, CSRF, password hashing, MFA, and object-level / function-level authorization (BOLA, IDOR) — confirming the caller may access the specific resource they asked for. Use when generating login, signup, or password-reset flows, issuing or verifying JWTs, writing OAuth or OIDC code, wiring session cookies or MFA, or writing any endpoint that reads or writes a resource by id.

shieldnet-360 Bundle

Strict CORS: no wildcard with credentials, exact-match origin allowlists, sane preflight cache, minimal exposed headers. Use when generating CORS middleware or framework config, setting CORS headers in API Gateway, CloudFront, or Nginx, or reviewing a cross-origin browser-facing endpoint.

shieldnet-360 Bundle

Wiring your application to a third-party SaaS platform: verifying an inbound webhook against the vendor's own scheme rather than a generalized one, why a valid signature identifies the sender and not the user in the payload, replay windows, one credential per integration and per environment, least-privilege scopes, and treating a bulk export as a data boundary. Use when writing a webhook receiver, an OAuth integration, a SCIM endpoint, or any code that authenticates to or from a SaaS vendor.

shieldnet-360 Bundle

Bound and control a GraphQL endpoint: operation cost budgets, cost-based rate limiting, pre-registered operations, alias and batch abuse on authentication paths, introspection, cache keying, and untyped scalar inputs. Use when generating schemas, resolvers, or server config, wiring limits or persisted operations, or reviewing a public /graphql endpoint.

shieldnet-360 Bundle

Keep secrets and personal data out of logs at the call site rather than relying on redaction, neutralize log and field injection, record audit events that survive, and treat log read access as data access. Use when generating logger calls or structured-logging schemas, wiring log shippers, sinks, retention, and access controls, or specifying audit-logging requirements.

shieldnet-360 Bundle

Keeping credentials out of source, and what to do once one is in: rotate before removing, because deleting the line does not un-leak it. Covers where a secret may live, safe .env templates, why a client-reachable config value is public, and running a scanner rather than eyeballing for patterns. Use when writing code that reads a credential, creating config or .env templates, before committing, or after discovering a secret in a repository.

shieldnet-360 Bundle

Harden Electron: renderer trust boundary (nodeIntegration, contextIsolation, sandbox), build-time fuses, contextBridge and IPC allowlists, shell.openExternal, navigation guards, deep-link auth, safeStorage. Use when generating main-process code, a preload script, or custom-protocol handlers, when packaging a release, or when storing tokens in an Electron app.

shieldnet-360 Bundle

Transport security where the client establishes trust: TLS version floor, certificate chain and hostname verification, the trust store, connecting by IP, mTLS and workload identity as authentication, gRPC channel credentials, and SMTP STARTTLS. Use when generating HTTP, gRPC, or SMTP clients and servers, configuring TLS in code or platform config, wiring service-to-service authentication, or when tempted to disable certificate verification.

shieldnet-360 Bundle

Securing the WebSocket upgrade and the frames after it: Origin validation against Cross-Site WebSocket Hijacking, authenticating the handshake rather than the first message, the ticket pattern for browsers that cannot set headers, per-frame authorization, and resource limits on a connection that stays open. Use when generating a WebSocket, Socket.IO, SignalR, or Phoenix Channels server, wiring real-time messaging, presence, or collaborative editing, or reviewing a /ws endpoint.

shieldnet-360 Bundle

Vet dependencies before they enter the build: typosquats, dependency confusion, malicious packages, known vulnerabilities, unlocked resolution, risky install and build hooks, EOL embedded runtimes, and the authenticity and freshness of your own release channel. Use when adding or upgrading a dependency, reviewing package manifests or lockfiles, configuring package sources or internal namespaces, or publishing a package or application update.

shieldnet-360 Bundle

Block unsafe deserialization and unsafe XML parsing in Java, Python, .NET, PHP, and Ruby: gadget chains, unrestricted type resolution, external entity expansion, and safer formats. Use when parsing or deserializing data from an untrusted source, wiring cookies, sessions, queues, or RPC payloads, or reviewing pickle, unserialize, Marshal, ObjectInputStream, BinaryFormatter, or XML parser configuration.

shieldnet-360 Bundle

Turning a confirmed and fixed finding into a permanent guard: proving the test fails without the fix, asserting the effect and not only the status code, seeding the two principals an authorization test needs, making a timing or out-of-band proof deterministic enough for CI, and keeping the test in a job that can actually block. Use once a security finding has been confirmed and fixed, or when a security test is failing, skipped, or about to be deleted.

questnova502 Bundle

Use when ANY command fails with 'command not found', when installing CLI tools (ripgrep, fd, jq, yq, bat, etc.), auditing project environments, or batch-updating tools. Triggers on: command not found, install tool, missing binary, environment audit, update tools, which, apt install, brew install.

tamircohen28 Bundle

Use when a repository's branch protection, rulesets, required checks, or PR-run cancellation may not match the canonical policy — a new repo that was never set up, a repo somebody configured by hand, an org whose repos were never brought into line, or a merge that was blocked or allowed in a way nobody expected. Also for: is this repo actually protected, why did that PR merge without CI, why is every PR asking me to update the branch, bring these repos into compliance, set up branch protection, audit my rulesets, apply the policy to all my repos, organization ruleset, convert classic branch protection to a ruleset, required approvals, cancel superseded PR runs.

tamircohen28 Bundle

Use when this repo may have fallen behind the AI coding platforms it targets — Claude Code, Codex CLI, Cursor, Gemini CLI, OpenCode. Triggers: 'what new features am I missing', 'am I up to date with the latest Claude Code docs', 'check my repo against the latest docs', 'is my plugin using current best practices', 'sync my plugin', 'audit every platform', 'did they ship anything new I should adopt', '/platform-sync'. Also use proactively when a platform manifest or CHANGELOG is being bumped, when a release is being cut, or when it has been more than a day since the last check. Fetches live docs per detected target and returns a numbered improvement plan; it never edits the repo itself.

wicttor Bundle

Analyze code for quality, security, tests, documentation, and integration issues.